24 May 2006 | 3,800 views

Security Researchers Afraid to Reveal Vulnerabilities

Cyber Raptors Hunting Your Data?

Well it happened a while back, remember? The French researcher Guillaume Tena who got in trouble for breaching French copywrite laws by decompiling some software.

Now people are generally starting to worry about disclosing vulnerabilities through any channels, does there need to be some kind of anonymous PGP key based system for vulnerability disclosure? So people can do it without fear of getting sued?

The CERIAS weblog examines the risks associated with reporting vulnerabilities. In the end, he advises that the risks (in one situation, at least) were almost not worth the trouble, and gives advice on how to stay out of trouble. Is it worth it to report vulnerabilities despite the risks, or is the chilling effect demonstrated here too much?

A typical difficulty encountered by vulnerability researchers is that administrators or programmers often deny that a problem is exploitable or is of any consequence, and request a proof. This got Eric McCarty in trouble & the proof is automatically a proof that you breached the law, and can be used to prosecute you!

It’s an interesting point when it comes to public disclosure, unless you have permission, how do you prove you’ve found a vulnerability without getting in trouble?

HD Moore also discussed this recently with:

Breach case could curtail Web flaw finders

Advertisements



Recent in Exploits/Vulnerabilities:
- Apple’s Password Storing Keychain Cracked on iOS & OS X
- The Logjam Attack – ANOTHER Critical TLS Weakness
- WordPress Critical Zero-Day Vulnerability Fixed In A Hurry

Related Posts:
- 3Com’s TippingPoint Finds New IE Vulnerabilities
- Sandcat by Syhunt – Web Server & Application Vulnerability Scanner
- What Responsibility do Anti-Spyware Researchers Have?

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 230,697 views
- AJAX: Is your application secure enough? - 119,546 views
- eEye Launches 0-Day Exploit Tracker - 85,232 views

Advertise on Darknet

Comments are closed.